iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
For every account that still uses a password, use a long, unique credential stored in a password manager. Turn on multifactor authentication (MFA) or use a passkey when the service supports it, and change a password when there is evidence it has been compromised—not just because time has passed. That is the practical core of password hygiene in 2026.
The current benchmark is NIST Special Publication 800-63B-4, published in July 2025. It sets requirements for password verifiers within the guideline’s scope; it does not mean every website follows those requirements. Individual services may still impose different rules or offer different sign-in options.
How do you create a good password?
Make each password unique and long, then let a password manager generate and store it. Reusing a password creates a chain of risk: if one service exposes it, an attacker may try the same credential on your other accounts. Distinct passwords help limit that kind of password-stuffing attack.
NIST SP 800-63B-4 sets a minimum of 15 characters for a password used as a single authentication factor. A verifier may set a minimum as low as eight characters when the password is used only as part of MFA. NIST says verifiers should allow passwords of at least 64 characters. These are verifier requirements and recommendations in the guideline, not a promise that every consumer website accepts passwords that long.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
NIST’s current guidance does not call for mandatory mixtures of uppercase and lowercase letters, numbers, and symbols. It prohibits those composition rules and instead requires verifiers to check proposed passwords against a blocklist of common, expected, or compromised choices. A long, unique password is useful, but it cannot by itself prevent every attack, including attacks against stolen password databases.
Why use a password manager?
A manager can create a different, long password for each account and retain it so you do not have to memorize or write down every credential. NIST’s consumer guidance says experts highly recommend a password manager for accounts that require passwords.
Protect the manager’s vault as carefully as you would a high-value account:
Recommended Free Tools
Rank #2
- Requires 3 "AAA" batteries (included)
- Unit auto-locks for 30 minutes after 5 consecutive incorrect PINs
- Choose a long passphrase for the manager’s master password.
- Enable MFA for the manager if it offers the option.
- Understand how master-password recovery works; recovery controls can affect access to the vault.
- Use the manager’s generator for new account passwords rather than adapting a password you already use.
Managers differ in their security designs and recovery processes, so these general practices do not establish that any particular product is suitable. NIST’s implementation guidance says password verifiers should support password managers and autofill, and recommends paste support when autofill is unavailable.
Should you use MFA or a passkey?
MFA adds another way to prove your identity, which can help protect an account if its password is compromised. NIST identifies authenticator apps, push notifications, text-message codes, and USB security devices among possible methods. They do not all provide the same protection; NIST specifically notes that text codes are vulnerable. Consider compatibility and how you will recover access if you lose the device or factor.
A passkey is a device-held digital key, commonly unlocked with a device PIN or biometric. NIST describes passkeys as distinct for each login and resistant to phishing: unlike a password typed into a deceptive site, a passkey cannot be easily stolen that way. Passkeys can work through phones, computers, security devices, or some browsers, but availability depends on the service and your devices.
A compatible FIDO2/passkey USB security key is an optional hardware MFA method, not a password manager. It does not replace unique passwords on services that still require them. Before choosing one, verify that it works with the accounts, connector, operating system, and recovery methods you rely on; no particular model is established here.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
When should you change a password?
Change a password when there is evidence the credential has been compromised. NIST SP 800-63B-4 states: “Verifiers and CSPs SHALL NOT require subscribers to change passwords periodically.” In other words, a fixed rotation schedule is not a universal best practice under the current guideline.
If a compromised password was reused, replace that same credential anywhere else you used it, giving each account a different password. Do not make a predictable edit—such as adding a new number or symbol to the old password—to satisfy an outdated composition rule.
Rank #4
- FIDO-ONLY FUNCTIONALITY: Supports FIDO2 (passkeys) and FIDO U2F protocols for passwordless and second-factor authentication. Does not support OTP, TOTP, Smart Card (PIV), or other advanced features - upgrade to YubiKey 5 Series for extended functionality
- SECURE AND CONVENIENT: Passwordless MFA login with the YubiKey Bio authenticator and biometric information using a fingerprint, with a PIN as a fallback. Simply plug in via USB and use your fingerprint to authenticate
- DEVICE & OS COMPATIBILITY: Compatible with Windows, macOS, ChromeOS, and Linux. Works seamlessly with supported services like Google and Microsoft accounts, and major password managers. See the full compatibility list at "Works With YubiKey"
- DURABLE & RELIABLE: Resistant to tampering, water, and crushing. No batteries or network connectivity required, offering dependable authentication without any downtime. Securely manufactured in USA & Sweden
- Yubico Authenticator App - Fingerprint enrollment, passkey management and PIN configuration available via the app app - Upgrade to YubiKey 5 Series to generate one-time-passwords (OTP) via Yubico Authenticator and for advanced compatibility (OATH, PIV)
What should a service do to protect passwords?
Password hygiene is not only an end-user responsibility. NIST’s current verifier guidance calls for safeguards on the service side, including:
- Checking new passwords against a blocklist of common, expected, or compromised passwords.
- Limiting failed authentication attempts.
- Supporting password managers and autofill, with paste support recommended when autofill is unavailable.
- Storing passwords using salted password hashing designed to resist offline attacks.
These are controls for password verifiers, not settings a customer can configure for a third-party service. NIST’s requirements apply within the guideline’s scope; the guidance is an authoritative benchmark, not evidence that every consumer service has implemented it.
What changed in NIST’s current password guidance?
NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management, is dated July 2025. NIST’s implementation FAQ describes several changes from the prior revision:
- The minimum for single-factor passwords rose from eight to 15 characters.
- Composition rules requiring particular character types are no longer allowed.
- Verifiers must not require periodic password changes; a change is required when there is evidence of compromise.
- Verifiers must allow password managers and autofill.
The standard also addresses character handling: verifiers should accept printable ASCII characters and spaces, as well as Unicode; each Unicode code point counts as one character when length is measured. A service’s actual password limits may differ if it has not adopted these requirements.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
